User Tools

Site Tools


connectors

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
Next revisionBoth sides next revision
connectors [2023/11/02 08:13] – [Security considerations] dmitryconnectors [2023/11/02 08:15] – [Database connectors] dmitry
Line 47: Line 47:
 |Apache Hive       |ODBC only  |Only import via visual queries and custom SQL | |Apache Hive       |ODBC only  |Only import via visual queries and custom SQL |
 |Google BigQuery   |ODBC only  |Only import via visual queries and custom SQL | |Google BigQuery   |ODBC only  |Only import via visual queries and custom SQL |
-|Denodo            |ODBC only  | |+|Denodo            |ODBC only  |Only import via visual queries and custom SQL |
 |Databricks        |ODBC only  | | |Databricks        |ODBC only  | |
 |Generic SQL:2003  |ODBC only  |Custom SQL only | |Generic SQL:2003  |ODBC only  |Custom SQL only |
Line 96: Line 96:
   * In connectors, use read-only accounts and don't expose unnecessary objects (e.g. schemas, tables, etc.)   * In connectors, use read-only accounts and don't expose unnecessary objects (e.g. schemas, tables, etc.)
   * Don't use embedded connectors for accessing sensitive information because they can be easily copied unless dynamic authentication is used (such as "Windows integrated")   * Don't use embedded connectors for accessing sensitive information because they can be easily copied unless dynamic authentication is used (such as "Windows integrated")
-  * Keep in mind that users may write and execute custom SQL queries/statements using connectors without knowing the credentials stored in the connectors+  * Keep in mind that users may perform various operations (e.g. write and execute custom SQL queries/statementsusing connectors without knowing the credentials stored in the connectors
   * SQL-related actions (such as "Import from database") and commands (such as "Custom SQL statement") insert [[parameters]] as plain text into the generated SQL statement which can make them vulnerable to SQL injection. Don't use parameters in such actions when parameter values can't be trusted or sanitized.   * SQL-related actions (such as "Import from database") and commands (such as "Custom SQL statement") insert [[parameters]] as plain text into the generated SQL statement which can make them vulnerable to SQL injection. Don't use parameters in such actions when parameter values can't be trusted or sanitized.
  
  
  
connectors.txt · Last modified: 2024/04/19 00:37 by dmitry

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki